Technical impact
The vulnerability is an Improper Control of Filename for Include/Require Statement in PHP, resulting in a Local File Inclusion flaw in the Melania theme for WordPress. An attacker who can influence the filename used in the include/require statement may be able to read or include sensitive local files, which could lead to disclosure of confidential data or execution of arbitrary code on the compromised site. The weakness is classified as CWE-98.
Affected Systems
This issue affects ThemeREX Melania themes for WordPress from the initial release through version 2.5.0. The vulnerability is not present in versions released after 2.5.0.
Risk and Exploitability
The CVSS v3 score of 8.1 indicates a high severity level. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker with access to the website can manipulate the include path to access local files. Exploitation would require the ability to direct the theme to include a malicious or sensitive file, but no prior setup or elevated privileges are explicitly required beyond normal web access.
